@aetherai/aether 0.0.7 → 0.0.8

package/dist/CLI/packages/core/src/mcp/oauth-utils.js

@@ -1,263 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { getErrorMessage } from '../utils/errors.js';
-import { createDebugLogger } from '../utils/debugLogger.js';
-const debugLogger = createDebugLogger('MCP_OAUTH');
-/**
- * Utility class for common OAuth operations.
- */
-export class OAuthUtils {
-    /**
-     * Construct well-known OAuth endpoint URLs.
-     * By default, uses standard root-based well-known URLs.
-     * If includePathSuffix is true, appends any path from the base URL to the well-known endpoints.
-     */
-    static buildWellKnownUrls(baseUrl, includePathSuffix = false) {
-        const serverUrl = new URL(baseUrl);
-        const base = `${serverUrl.protocol}//${serverUrl.host}`;
-        if (!includePathSuffix) {
-            // Standard discovery: use root-based well-known URLs
-            return {
-                protectedResource: new URL('/.well-known/oauth-protected-resource', base).toString(),
-                authorizationServer: new URL('/.well-known/oauth-authorization-server', base).toString(),
-            };
-        }
-        // Path-based discovery: append path suffix to well-known URLs
-        const pathSuffix = serverUrl.pathname.replace(/\/$/, ''); // Remove trailing slash
-        return {
-            protectedResource: new URL(`/.well-known/oauth-protected-resource${pathSuffix}`, base).toString(),
-            authorizationServer: new URL(`/.well-known/oauth-authorization-server${pathSuffix}`, base).toString(),
-        };
-    }
-    /**
-     * Fetch OAuth protected resource metadata.
-     *
-     * @param resourceMetadataUrl The protected resource metadata URL
-     * @returns The protected resource metadata or null if not available
-     */
-    static async fetchProtectedResourceMetadata(resourceMetadataUrl) {
-        try {
-            const response = await fetch(resourceMetadataUrl);
-            if (!response.ok) {
-                return null;
-            }
-            return (await response.json());
-        }
-        catch (error) {
-            debugLogger.debug(`Failed to fetch protected resource metadata from ${resourceMetadataUrl}: ${getErrorMessage(error)}`);
-            return null;
-        }
-    }
-    /**
-     * Fetch OAuth authorization server metadata.
-     *
-     * @param authServerMetadataUrl The authorization server metadata URL
-     * @returns The authorization server metadata or null if not available
-     */
-    static async fetchAuthorizationServerMetadata(authServerMetadataUrl) {
-        try {
-            const response = await fetch(authServerMetadataUrl);
-            if (!response.ok) {
-                return null;
-            }
-            return (await response.json());
-        }
-        catch (error) {
-            debugLogger.debug(`Failed to fetch authorization server metadata from ${authServerMetadataUrl}: ${getErrorMessage(error)}`);
-            return null;
-        }
-    }
-    /**
-     * Convert authorization server metadata to OAuth configuration.
-     *
-     * @param metadata The authorization server metadata
-     * @returns The OAuth configuration
-     */
-    static metadataToOAuthConfig(metadata) {
-        return {
-            authorizationUrl: metadata.authorization_endpoint,
-            tokenUrl: metadata.token_endpoint,
-            scopes: metadata.scopes_supported || [],
-            registrationUrl: metadata.registration_endpoint,
-        };
-    }
-    /**
-     * Discover Oauth Authorization server metadata given an Auth server URL, by
-     * trying the standard well-known endpoints.
-     *
-     * @param authServerUrl The authorization server URL
-     * @returns The authorization server metadata or null if not found
-     */
-    static async discoverAuthorizationServerMetadata(authServerUrl) {
-        const authServerUrlObj = new URL(authServerUrl);
-        const base = `${authServerUrlObj.protocol}//${authServerUrlObj.host}`;
-        const endpointsToTry = [];
-        // With issuer URLs with path components, try the following well-known
-        // endpoints in order:
-        if (authServerUrlObj.pathname !== '/') {
-            // 1. OAuth 2.0 Authorization Server Metadata with path insertion
-            endpointsToTry.push(new URL(`/.well-known/oauth-authorization-server${authServerUrlObj.pathname}`, base).toString());
-            // 2. OpenID Connect Discovery 1.0 with path insertion
-            endpointsToTry.push(new URL(`/.well-known/openid-configuration${authServerUrlObj.pathname}`, base).toString());
-            // 3. OpenID Connect Discovery 1.0 with path appending
-            endpointsToTry.push(new URL(`${authServerUrlObj.pathname}/.well-known/openid-configuration`, base).toString());
-        }
-        // With issuer URLs without path components, and those that failed previous
-        // discoveries, try the following well-known endpoints in order:
-        // 1. OAuth 2.0 Authorization Server Metadata
-        endpointsToTry.push(new URL('/.well-known/oauth-authorization-server', base).toString());
-        // 2. OpenID Connect Discovery 1.0
-        endpointsToTry.push(new URL('/.well-known/openid-configuration', base).toString());
-        for (const endpoint of endpointsToTry) {
-            const authServerMetadata = await this.fetchAuthorizationServerMetadata(endpoint);
-            if (authServerMetadata) {
-                return authServerMetadata;
-            }
-        }
-        debugLogger.debug(`Metadata discovery failed for authorization server ${authServerUrl}`);
-        return null;
-    }
-    /**
-     * Discover OAuth configuration using the standard well-known endpoints.
-     *
-     * @param serverUrl The base URL of the server
-     * @returns The discovered OAuth configuration or null if not available
-     */
-    static async discoverOAuthConfig(serverUrl) {
-        try {
-            // First try standard root-based discovery
-            const wellKnownUrls = this.buildWellKnownUrls(serverUrl, false);
-            // Try to get the protected resource metadata at root
-            let resourceMetadata = await this.fetchProtectedResourceMetadata(wellKnownUrls.protectedResource);
-            // If root discovery fails and we have a path, try path-based discovery
-            if (!resourceMetadata) {
-                const url = new URL(serverUrl);
-                if (url.pathname && url.pathname !== '/') {
-                    const pathBasedUrls = this.buildWellKnownUrls(serverUrl, true);
-                    resourceMetadata = await this.fetchProtectedResourceMetadata(pathBasedUrls.protectedResource);
-                }
-            }
-            if (resourceMetadata?.authorization_servers?.length) {
-                // Use the first authorization server
-                const authServerUrl = resourceMetadata.authorization_servers[0];
-                const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
-                if (authServerMetadata) {
-                    const config = this.metadataToOAuthConfig(authServerMetadata);
-                    // Merge scopes from protected resource metadata (RFC 9728)
-                    // Protected resource scopes take precedence as they define the specific access requirements
-                    if (resourceMetadata.scopes_supported?.length) {
-                        config.scopes = resourceMetadata.scopes_supported;
-                    }
-                    if (authServerMetadata.registration_endpoint) {
-                        debugLogger.debug(`Dynamic client registration is supported at: ${authServerMetadata.registration_endpoint}`);
-                    }
-                    return config;
-                }
-            }
-            // Fallback: try well-known endpoints at the base URL
-            debugLogger.debug(`Trying OAuth discovery fallback at ${serverUrl}`);
-            const authServerMetadata = await this.discoverAuthorizationServerMetadata(serverUrl);
-            if (authServerMetadata) {
-                const config = this.metadataToOAuthConfig(authServerMetadata);
-                if (authServerMetadata.registration_endpoint) {
-                    debugLogger.debug(`Dynamic client registration is supported at: ${authServerMetadata.registration_endpoint}`);
-                }
-                return config;
-            }
-            return null;
-        }
-        catch (error) {
-            debugLogger.debug(`Failed to discover OAuth configuration: ${getErrorMessage(error)}`);
-            return null;
-        }
-    }
-    /**
-     * Parse WWW-Authenticate header to extract OAuth information.
-     *
-     * @param header The WWW-Authenticate header value
-     * @returns The resource metadata URI if found
-     */
-    static parseWWWAuthenticateHeader(header) {
-        // Parse Bearer realm and resource_metadata
-        const match = header.match(/resource_metadata="([^"]+)"/);
-        if (match) {
-            return match[1];
-        }
-        return null;
-    }
-    /**
-     * Discover OAuth configuration from WWW-Authenticate header.
-     *
-     * @param wwwAuthenticate The WWW-Authenticate header value
-     * @returns The discovered OAuth configuration or null if not available
-     */
-    static async discoverOAuthFromWWWAuthenticate(wwwAuthenticate) {
-        const resourceMetadataUri = this.parseWWWAuthenticateHeader(wwwAuthenticate);
-        if (!resourceMetadataUri) {
-            return null;
-        }
-        const resourceMetadata = await this.fetchProtectedResourceMetadata(resourceMetadataUri);
-        if (!resourceMetadata?.authorization_servers?.length) {
-            return null;
-        }
-        const authServerUrl = resourceMetadata.authorization_servers[0];
-        const authServerMetadata = await this.discoverAuthorizationServerMetadata(authServerUrl);
-        if (authServerMetadata) {
-            const config = this.metadataToOAuthConfig(authServerMetadata);
-            // Merge scopes from protected resource metadata (RFC 9728)
-            // Protected resource scopes take precedence as they define the specific access requirements
-            if (resourceMetadata.scopes_supported?.length) {
-                config.scopes = resourceMetadata.scopes_supported;
-            }
-            return config;
-        }
-        return null;
-    }
-    /**
-     * Extract base URL from an MCP server URL.
-     *
-     * @param mcpServerUrl The MCP server URL
-     * @returns The base URL
-     */
-    static extractBaseUrl(mcpServerUrl) {
-        const serverUrl = new URL(mcpServerUrl);
-        return `${serverUrl.protocol}//${serverUrl.host}`;
-    }
-    /**
-     * Check if a URL is an SSE endpoint.
-     *
-     * @param url The URL to check
-     * @returns True if the URL appears to be an SSE endpoint
-     */
-    static isSSEEndpoint(url) {
-        return url.includes('/sse') || !url.includes('/mcp');
-    }
-    /**
-     * Build a resource parameter for OAuth requests.
-     *
-     * Per MCP spec and RFC 8707, the resource parameter MUST be the
-     * canonical URI of the MCP server. Clients SHOULD provide the most
-     * specific URI they can. The URI MUST NOT include a fragment and
-     * SHOULD NOT include a query component.
-     *
-     * @param endpointUrl The MCP server endpoint URL
-     * @returns The canonical resource URI
-     */
-    static buildResourceParameter(endpointUrl) {
-        const url = new URL(endpointUrl);
-        // Build canonical URI: scheme + host + path (no query, no fragment)
-        // per RFC 8707 Section 2 and MCP spec Resource Parameter Implementation
-        const path = url.pathname === '/' ? '' : url.pathname;
-        let canonical = `${url.protocol}//${url.host}${path}`;
-        // Remove trailing slash from non-root paths for consistency
-        // (MCP spec recommends form without trailing slash)
-        if (canonical.endsWith('/') && path !== '') {
-            canonical = canonical.slice(0, -1);
-        }
-        return canonical;
-    }
-}
-//# sourceMappingURL=oauth-utils.js.map

package/dist/CLI/packages/core/src/mcp/oauth-utils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth-utils.js","sourceRoot":"","sources":["../../../../../../../core/src/mcp/oauth-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;AAiCnD;;GAEG;AACH,MAAM,OAAO,UAAU;IACrB;;;;OAIG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAAe,EAAE,iBAAiB,GAAG,KAAK;QAClE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAExD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,qDAAqD;YACrD,OAAO;gBACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,uCAAuC,EACvC,IAAI,CACL,CAAC,QAAQ,EAAE;gBACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,yCAAyC,EACzC,IAAI,CACL,CAAC,QAAQ,EAAE;aACb,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;QAClF,OAAO;YACL,iBAAiB,EAAE,IAAI,GAAG,CACxB,wCAAwC,UAAU,EAAE,EACpD,IAAI,CACL,CAAC,QAAQ,EAAE;YACZ,mBAAmB,EAAE,IAAI,GAAG,CAC1B,0CAA0C,UAAU,EAAE,EACtD,IAAI,CACL,CAAC,QAAQ,EAAE;SACb,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,8BAA8B,CACzC,mBAA2B;QAE3B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,oDAAoD,mBAAmB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,qBAA6B;QAE7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,sDAAsD,qBAAqB,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACzG,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,qBAAqB,CAC1B,QAA0C;QAE1C,OAAO;YACL,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB;YACjD,QAAQ,EAAE,QAAQ,CAAC,cAAc;YACjC,MAAM,EAAE,QAAQ,CAAC,gBAAgB,IAAI,EAAE;YACvC,eAAe,EAAE,QAAQ,CAAC,qBAAqB;SAChD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAC9C,aAAqB;QAErB,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,gBAAgB,CAAC,QAAQ,KAAK,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEtE,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,sEAAsE;QACtE,sBAAsB;QACtB,IAAI,gBAAgB,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;YACtC,iEAAiE;YACjE,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,0CAA0C,gBAAgB,CAAC,QAAQ,EAAE,EACrE,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,oCAAoC,gBAAgB,CAAC,QAAQ,EAAE,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;YAEF,sDAAsD;YACtD,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CACL,GAAG,gBAAgB,CAAC,QAAQ,mCAAmC,EAC/D,IAAI,CACL,CAAC,QAAQ,EAAE,CACb,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,gEAAgE;QAEhE,6CAA6C;QAC7C,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CACpE,CAAC;QAEF,kCAAkC;QAClC,cAAc,CAAC,IAAI,CACjB,IAAI,GAAG,CAAC,mCAAmC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAC9D,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,CAAC;YACtC,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC;YACxD,IAAI,kBAAkB,EAAE,CAAC;gBACvB,OAAO,kBAAkB,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,WAAW,CAAC,KAAK,CACf,sDAAsD,aAAa,EAAE,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,SAAiB;QAEjB,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAEhE,qDAAqD;YACrD,IAAI,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC9D,aAAa,CAAC,iBAAiB,CAChC,CAAC;YAEF,uEAAuE;YACvE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC/B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;oBAC/D,gBAAgB,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAC1D,aAAa,CAAC,iBAAiB,CAChC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,IAAI,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;gBACpD,qCAAqC;gBACrC,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;gBAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;gBAEhE,IAAI,kBAAkB,EAAE,CAAC;oBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;oBAC9D,2DAA2D;oBAC3D,4FAA4F;oBAC5F,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;wBAC9C,MAAM,CAAC,MAAM,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;oBACpD,CAAC;oBACD,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;wBAC7C,WAAW,CAAC,KAAK,CACf,gDAAgD,kBAAkB,CAAC,qBAAqB,EAAE,CAC3F,CAAC;oBACJ,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,WAAW,CAAC,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;YACrE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;YAE5D,IAAI,kBAAkB,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;oBAC7C,WAAW,CAAC,KAAK,CACf,gDAAgD,kBAAkB,CAAC,qBAAqB,EAAE,CAC3F,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CACf,2CAA2C,eAAe,CAAC,KAAK,CAAC,EAAE,CACpE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,0BAA0B,CAAC,MAAc;QAC9C,2CAA2C;QAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAC3C,eAAuB;QAEvB,MAAM,mBAAmB,GACvB,IAAI,CAAC,0BAA0B,CAAC,eAAe,CAAC,CAAC;QACnD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GACpB,MAAM,IAAI,CAAC,8BAA8B,CAAC,mBAAmB,CAAC,CAAC;QACjE,IAAI,CAAC,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,kBAAkB,GACtB,MAAM,IAAI,CAAC,mCAAmC,CAAC,aAAa,CAAC,CAAC;QAEhE,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;YAC9D,2DAA2D;YAC3D,4FAA4F;YAC5F,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC;gBAC9C,MAAM,CAAC,MAAM,GAAG,gBAAgB,CAAC,gBAAgB,CAAC;YACpD,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,YAAoB;QACxC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,GAAW;QAC9B,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,sBAAsB,CAAC,WAAmB;QAC/C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACjC,oEAAoE;QACpE,wEAAwE;QACxE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACtD,IAAI,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;QACtD,4DAA4D;QAC5D,oDAAoD;QACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAC3C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/CLI/packages/core/src/mcp/sa-impersonation-provider.d.ts

@@ -1,33 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import type { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
-import type { MCPServerConfig } from '../config/config.js';
-import type { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
-export declare class ServiceAccountImpersonationProvider implements OAuthClientProvider {
-    private readonly config;
-    private readonly targetServiceAccount;
-    private readonly targetAudience;
-    private readonly auth;
-    private cachedToken?;
-    private tokenExpiryTime?;
-    readonly redirectUrl = "";
-    readonly clientMetadata: OAuthClientMetadata;
-    private _clientInformation?;
-    constructor(config: MCPServerConfig);
-    clientInformation(): OAuthClientInformation | undefined;
-    saveClientInformation(clientInformation: OAuthClientInformationFull): void;
-    tokens(): Promise<OAuthTokens | undefined>;
-    saveTokens(_tokens: OAuthTokens): void;
-    redirectToAuthorization(_authorizationUrl: URL): void;
-    saveCodeVerifier(_codeVerifier: string): void;
-    codeVerifier(): string;
-    /**
-     * Parses a JWT string to extract its expiry time.
-     * @param idToken The JWT ID token.
-     * @returns The expiry time in **milliseconds**, or undefined if parsing fails.
-     */
-    private parseTokenExpiry;
-}

package/dist/CLI/packages/core/src/mcp/sa-impersonation-provider.js

@@ -1,133 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { GoogleAuth } from 'google-auth-library';
-import { MCP_SA_IMPERSONATION_CLIENT_NAME } from './constants.js';
-import { createDebugLogger } from '../utils/debugLogger.js';
-const debugLogger = createDebugLogger('MCP_SA_IMPERSONATION');
-const fiveMinBufferMs = 5 * 60 * 1000;
-function createIamApiUrl(targetSA) {
-    return `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${encodeURIComponent(targetSA)}:generateIdToken`;
-}
-export class ServiceAccountImpersonationProvider {
-    config;
-    targetServiceAccount;
-    targetAudience; // OAuth Client Id
-    auth;
-    cachedToken;
-    tokenExpiryTime;
-    // Properties required by OAuthClientProvider, with no-op values
-    redirectUrl = '';
-    clientMetadata = {
-        client_name: MCP_SA_IMPERSONATION_CLIENT_NAME,
-        redirect_uris: [],
-        grant_types: [],
-        response_types: [],
-        token_endpoint_auth_method: 'none',
-    };
-    _clientInformation;
-    constructor(config) {
-        this.config = config;
-        // This check is done in mcp-client.ts. This is just an additional check.
-        if (!this.config.httpUrl && !this.config.url) {
-            throw new Error('A url or httpUrl must be provided for the Service Account Impersonation provider');
-        }
-        if (!config.targetAudience) {
-            throw new Error('targetAudience must be provided for the Service Account Impersonation provider');
-        }
-        this.targetAudience = config.targetAudience;
-        if (!config.targetServiceAccount) {
-            throw new Error('targetServiceAccount must be provided for the Service Account Impersonation provider');
-        }
-        this.targetServiceAccount = config.targetServiceAccount;
-        this.auth = new GoogleAuth();
-    }
-    clientInformation() {
-        return this._clientInformation;
-    }
-    saveClientInformation(clientInformation) {
-        this._clientInformation = clientInformation;
-    }
-    async tokens() {
-        // 1. Check if we have a valid, non-expired cached token.
-        if (this.cachedToken &&
-            this.tokenExpiryTime &&
-            Date.now() < this.tokenExpiryTime - fiveMinBufferMs) {
-            return this.cachedToken;
-        }
-        // 2. Clear any invalid/expired cache.
-        this.cachedToken = undefined;
-        this.tokenExpiryTime = undefined;
-        // 3. Fetch a new ID token.
-        const client = await this.auth.getClient();
-        const url = createIamApiUrl(this.targetServiceAccount);
-        let idToken;
-        try {
-            const res = await client.request({
-                url,
-                method: 'POST',
-                data: {
-                    audience: this.targetAudience,
-                    includeEmail: true,
-                },
-            });
-            idToken = res.data.token;
-            if (!idToken || idToken.length === 0) {
-                debugLogger.error('Failed to get ID token from Google');
-                return undefined;
-            }
-        }
-        catch (e) {
-            debugLogger.error(`Failed to fetch ID token from Google: ${e}`);
-            return undefined;
-        }
-        const expiryTime = this.parseTokenExpiry(idToken);
-        // Note: We are placing the OIDC ID Token into the `access_token` field.
-        // This is because the CLI uses this field to construct the
-        // `Authorization: Bearer <token>` header, which is the correct way to
-        // present an ID token.
-        const newTokens = {
-            access_token: idToken,
-            token_type: 'Bearer',
-        };
-        if (expiryTime) {
-            this.tokenExpiryTime = expiryTime;
-            this.cachedToken = newTokens;
-        }
-        return newTokens;
-    }
-    saveTokens(_tokens) {
-        // No-op
-    }
-    redirectToAuthorization(_authorizationUrl) {
-        // No-op
-    }
-    saveCodeVerifier(_codeVerifier) {
-        // No-op
-    }
-    codeVerifier() {
-        // No-op
-        return '';
-    }
-    /**
-     * Parses a JWT string to extract its expiry time.
-     * @param idToken The JWT ID token.
-     * @returns The expiry time in **milliseconds**, or undefined if parsing fails.
-     */
-    parseTokenExpiry(idToken) {
-        try {
-            const payload = JSON.parse(Buffer.from(idToken.split('.')[1], 'base64').toString());
-            if (payload && typeof payload.exp === 'number') {
-                return payload.exp * 1000; // Convert seconds to milliseconds
-            }
-        }
-        catch (e) {
-            debugLogger.error(`Failed to parse ID token for expiry time with error: ${e}`);
-        }
-        // Return undefined if try block fails or 'exp' is missing/invalid
-        return undefined;
-    }
-}
-//# sourceMappingURL=sa-impersonation-provider.js.map

package/dist/CLI/packages/core/src/mcp/sa-impersonation-provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sa-impersonation-provider.js","sourceRoot":"","sources":["../../../../../../../core/src/mcp/sa-impersonation-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjD,OAAO,EAAE,gCAAgC,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;AAE9D,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,eAAe,CAAC,QAAgB;IACvC,OAAO,uEAAuE,kBAAkB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;AAC/H,CAAC;AAED,MAAM,OAAO,mCAAmC;IAoBjB;IAjBZ,oBAAoB,CAAS;IAC7B,cAAc,CAAS,CAAC,kBAAkB;IAC1C,IAAI,CAAa;IAC1B,WAAW,CAAe;IAC1B,eAAe,CAAU;IAEjC,gEAAgE;IACvD,WAAW,GAAG,EAAE,CAAC;IACjB,cAAc,GAAwB;QAC7C,WAAW,EAAE,gCAAgC;QAC7C,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,0BAA0B,EAAE,MAAM;KACnC,CAAC;IACM,kBAAkB,CAA8B;IAExD,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;QAClD,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAE5C,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAExD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;IAC/B,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,kBAAkB,CAAC;IACjC,CAAC;IAED,qBAAqB,CAAC,iBAA6C;QACjE,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM;QACV,yDAAyD;QACzD,IACE,IAAI,CAAC,WAAW;YAChB,IAAI,CAAC,eAAe;YACpB,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,GAAG,eAAe,EACnD,CAAC;YACD,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QAEjC,2BAA2B;QAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEvD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAoB;gBAClD,GAAG;gBACH,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,QAAQ,EAAE,IAAI,CAAC,cAAc;oBAC7B,YAAY,EAAE,IAAI;iBACnB;aACF,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAEzB,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrC,WAAW,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACxD,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,KAAK,CAAC,yCAAyC,CAAC,EAAE,CAAC,CAAC;YAChE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAClD,wEAAwE;QACxE,2DAA2D;QAC3D,sEAAsE;QACtE,uBAAuB;QACvB,MAAM,SAAS,GAAgB;YAC7B,YAAY,EAAE,OAAO;YACrB,UAAU,EAAE,QAAQ;SACrB,CAAC;QAEF,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;YAClC,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,OAAoB;QAC7B,QAAQ;IACV,CAAC;IAED,uBAAuB,CAAC,iBAAsB;QAC5C,QAAQ;IACV,CAAC;IAED,gBAAgB,CAAC,aAAqB;QACpC,QAAQ;IACV,CAAC;IAED,YAAY;QACV,QAAQ;QACR,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,OAAe;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CACxD,CAAC;YAEF,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC/C,OAAO,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,kCAAkC;YAC/D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,WAAW,CAAC,KAAK,CACf,wDAAwD,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/CLI/packages/core/src/mcp/token-storage/base-token-storage.d.ts

@@ -1,19 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import type { TokenStorage, OAuthCredentials } from './types.js';
-export declare abstract class BaseTokenStorage implements TokenStorage {
-    protected readonly serviceName: string;
-    constructor(serviceName: string);
-    abstract getCredentials(serverName: string): Promise<OAuthCredentials | null>;
-    abstract setCredentials(credentials: OAuthCredentials): Promise<void>;
-    abstract deleteCredentials(serverName: string): Promise<void>;
-    abstract listServers(): Promise<string[]>;
-    abstract getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
-    abstract clearAll(): Promise<void>;
-    protected validateCredentials(credentials: OAuthCredentials): void;
-    protected isTokenExpired(credentials: OAuthCredentials): boolean;
-    protected sanitizeServerName(serverName: string): string;
-}

package/dist/CLI/packages/core/src/mcp/token-storage/base-token-storage.js

@@ -1,36 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-export class BaseTokenStorage {
-    serviceName;
-    constructor(serviceName) {
-        this.serviceName = serviceName;
-    }
-    validateCredentials(credentials) {
-        if (!credentials.serverName) {
-            throw new Error('Server name is required');
-        }
-        if (!credentials.token) {
-            throw new Error('Token is required');
-        }
-        if (!credentials.token.accessToken) {
-            throw new Error('Access token is required');
-        }
-        if (!credentials.token.tokenType) {
-            throw new Error('Token type is required');
-        }
-    }
-    isTokenExpired(credentials) {
-        if (!credentials.token.expiresAt) {
-            return false;
-        }
-        const bufferMs = 5 * 60 * 1000;
-        return Date.now() > credentials.token.expiresAt - bufferMs;
-    }
-    sanitizeServerName(serverName) {
-        return serverName.replace(/[^a-zA-Z0-9-_.]/g, '_');
-    }
-}
-//# sourceMappingURL=base-token-storage.js.map

package/dist/CLI/packages/core/src/mcp/token-storage/base-token-storage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"base-token-storage.js","sourceRoot":"","sources":["../../../../../../../../core/src/mcp/token-storage/base-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,OAAgB,gBAAgB;IACjB,WAAW,CAAS;IAEvC,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IASS,mBAAmB,CAAC,WAA6B;QACzD,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAES,cAAc,CAAC,WAA6B;QACpD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC7D,CAAC;IAES,kBAAkB,CAAC,UAAkB;QAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/CLI/packages/core/src/mcp/token-storage/file-token-storage.d.ts

@@ -1,24 +0,0 @@
-/**
- * @license
- * Copyright 2025 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { BaseTokenStorage } from './base-token-storage.js';
-import type { OAuthCredentials } from './types.js';
-export declare class FileTokenStorage extends BaseTokenStorage {
-    private readonly tokenFilePath;
-    private readonly encryptionKey;
-    constructor(serviceName: string);
-    private deriveEncryptionKey;
-    private encrypt;
-    private decrypt;
-    private ensureDirectoryExists;
-    private loadTokens;
-    private saveTokens;
-    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
-    setCredentials(credentials: OAuthCredentials): Promise<void>;
-    deleteCredentials(serverName: string): Promise<void>;
-    listServers(): Promise<string[]>;
-    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
-    clearAll(): Promise<void>;
-}